Permissions bug in OS X 10.5 - unable to update applications

I hate OS X permissions problems.

There were enough of them before Apple introduced ACLs in 10.4 alongside UNIX permissions. The dual parallel systems hasn't made things any easier.

Evil apps, like just about anything that Adobe makes or anything that uses a VISE installer, are prone to wreck permissions. Rumor has it that using "apply to enclosed items" changes to the Application and Utilities folders can have unexpected consequences.

To add injury to insult, running "Repair Permissions" from the OS X disk utility app never seems to fix anything. (I think that's a Potemkin application).

So, I had a permissions problem. Again.
Since upgrading to 10.5, when I try to update applications by dropping new versions into my (all user) Applications folder I get this message -- despite entering my admin credentials on request: "The operation cannot be completed because you do not have sufficient privileges for some of the items."

The target application will be partly removed at this point. I have to delete it (no problems) and then drop the new one on.

A minor annoyance, but aggravating.

I figured I'd have to fix it sooner or later, but today my daughter complained that her evil Flash using kid sites were crashing. Time to update Adobe's little OS X virus, aka Flash. Except I was getting Access denied errors from the evil VISE (of course) installer. I'd already tried repairing permissions, so I knew I had to do more.

Others had run into the same problem: Apple - Support - Discussions - The operation cannot be completed - you .... VK (level 4!) advised (modified slightly here):

... sounds like you have incorrect permissions and ACLs on your Applications folder.

Run the following terminal commands from an admin account ... copy and paste the commands into a terminal window.

sudo chown -R root:admin /Applications
(This will reset the ownership on /Applications to system defaults.)

You'll have to enter your admin password when its requested. You won't see anything when you enter it. These tasks can take a few minutes to complete, so just wait -- there's no progress dialog. Depending how long execution takes you may need to reenter your password. Wait for the prompt to return before entering commands.

next

sudo chmod -R g+w,+X /Applications
(this should set unix permissions correctly)

next

sudo chmod -RN /Applications
(this will delete all ACLs from everything in /Applications)

next

sudo chmod +a "everyone deny delete" /Applications /Applications/Utilities
(this will put the necessary ACLs back where they belong)

I tried installing the latest version of Onyx to see if it had a bundled fix, but it didn't. So, with some reluctance, I followed the above.

I then did a safe boot restart, then a regular restart, and then I ran repair permissions from Disk Utility. DU didn't like the settings VK recommended -- it changed many of them. I'm not sure who's right here, because an evil app can mess up the permissions database (Ex. an Adobe product) and repair permissions might be getting bad advice.

After that I run Adobe's Flash Installer (drag it from the DMG file to run it). It still gave me access errors, but I was pretty sure I'd removed all Flash stuff by hand. I suspect Adobe's Flash uninstaller is old.

I tried the Flash 9 for Intell installer again (drag it from DMG file to run) and this time I didn't get any privilege warnings.

So now I'll see how my next app update goes. Next step is probably a clean install.

Non-geeks don't have a chance with this stuff - or bad design?

1. Having both ACLs and BSD permissions at the same time is just asking for trouble.
2. It's wrong that badly behaved installers should be able to wreck permissions. (Apple should at least put up a warning ... something like ... "this ill-bred Adobe product is going to wreck your system, we recommend Aperture instead ..."
3. Repair permissions ought to work better than it does. It shouldn't be getting its settings from a corruptible source.

Update 11/20/08: Some better fixes have been discovered.

Update 9/16/10: The official fix.

Sync with MobileMe - how to control the direction of the initial sync

The MobileMe help file was useless, but this Apple forum post has the answer. In this case the configuration will overwrite iCal with MobileMe data, but you can invert the direction at step 6.

Apple - Support - Discussions - Help overwriting iCal with Cloud ...

1) Open MobileMe Preferences, and click on the 'Sync' tab.
2) Ensure that 'Synchronise with MobileMe' to 'Manual'
3) Click on 'Advanced...'
4) Click on 'Reset Sync Data...'
5) A window will appear, saying 'Replace: {All Sync Info}'. Use the list to change this to:
Replace: {Calendars}
6) Make sure that the animated arrow is flowing from the cloud to the mac. You can change its direction by clicking on the arrows underneath the image.
7) Click on replace.

I did this with the 10.4 .Mac preferences (after update, the name doesn't change) and it worked there.

It's not obvious how to do this for only one of the many sync options you have. I think if you switch to manual sync, then uncheck all but the item you want to sync uni-directionally, you can leave the other sync items untouched.

Google Chrome doesn't like Google Docs

It wasn't hard to see that Chrome doesn't like Google Docs. When I tried to highlight an entire spreadsheet row, the last column was missed. When I tried to copy and paste a row, the results were odd.

Then I pasted into a cell, selected text, and cleared formatting ...

Well, we knew it's early beta.

Still, I didn't expect it to blow up so quickly in Google's own backyard. This ain't subtle, the Chrome team must have know about the problem.

I've seen similar results, maybe a bit better, when I've used Safari on Google Apps. Safari and Chrome both use WebKit, in contrast Gecko browser (Camino, Firefox) work pretty well.

My guess is that there's some bad code in the Google Apps - spreadsheet and probably doc. So maybe the next step is to cleanup Google Apps -- which will help Safari.

At least this bug ain't hard to find!

ATPM's task and GTD app catalog now with iPhone info

ATPM 14.09 - Next Actions: Master List for September is a catalog of OS X apps for "getting things done" -- what we old timers new as a task list (plus).

Now it includes an 'iPhone Presence' indicator. It's a terrific list.

BTW, I'm still pretty happy with the combination of Toodledo (web site) and iPhone ToDo.app. Not cheap, but being able to work with tasks from any computer is worth something.

Picasa web album face tagging - not only fun

I didn't think my wife and her brother looked that much alike, but I can't argue with Google's face recognition algorithm. At a particular angle, in a particular light, there's a definite resemblance!

Yes, Picasa's facial recognition software is a grade 2 event ...

Gordon's Notes: Singularity alert: Picasa web album face tagging

... Yeah, we all knew it was coming, but it's creepy-cool anyway. Not quite goose bumps, but a grade 2 singularity event. (Grade 7 is when the Great God Google refers you to your soylent green processing station, Grade 1 is personalized search.)

So will Google link the faces to the appropriate Google Profile? You just know they've got that one on their social networking strategy. (So how do kids get their profiles? Is it like Confirmation?)

I love it. Now if there were only some way to sync the tags back to iPhoto ...

I'll report on my tech blog after I try it. I'm sure the servers will be smoking tonight, so it'll take a few days. (Update: yeah, it's pegged. Stuck at 44% of faces.)..

It took a day or so, but a lot of faces are recognized. The tagging UI is excellent. I was joking about the Google Profile, but I wasn't far off. Google matches tags against one's Gmail contacts and attaches email addresses in the tags.

Now we need to sync the tags back to iPhoto. This really needs to be in the next version of everyone's photo management software.

Privacy? Hah. That's strictly for the impoverished and the ultra-rich.

CroCari: the future of OS X browsers

With the release of Chrome for Windows, all OS X geeks think the same thoughts:

1. Safari/web kit should be replaced with Chrome/web kit.
2. The Camino engineers are best able to integrate Chrome with OS X

So this is very good news.

Daring Fireball Linked List: Pinkerton

Mike Pinkerton, long-time Mac web browser developer, and one of the leaders behind the Gecko-based Camino, is also involved in Google’s efforts to create a Mac browser based on Chromium.

Chrome + Camino + Safari = CroCari.

Software evaluation: now we have to watch out for license tokens!

[See the update -- 1Password changed their policy today!]

I was read to buy 1Password. I clicked to purchase, and discovered 1Password uses license tokens!

Damn.

I'd never have invested in testing the product if I'd known that. These encrypted license tokens are a pain to manage and store. I want nothing to do with 'em. Mercifully, they're not too common ... yet.

So now I'm back looking for an iPhone password management solution. Maybe FileMaker will deliver Bento/iPhone with encryption and I won't have to bother with a dedicated app.

I'll try to avoid this mistake again. From now on, I'll walk through the purchase process before testing a product to avoid an entire class of nasty surprises.

Update 9/3/08: To be fair to 1Password, I went to the trouble of writing an email so they'd know this was a problem for one customer. They wrote back and said something like "yeah, you're right, as of today registration gets you a regular registration number". So they'd been hearing this was a problem. I'll download the new version and register tonight.